From 95475f658abfd26971e998b9c4134299a269a967 Mon Sep 17 00:00:00 2001
From: Dag Brattli <dag.brattli@cognite.com>
Date: Fri, 19 Dec 2025 00:02:18 +0100
Subject: [PATCH] [All] pin transitive dependencies

Pin Microsoft.Build transitive dependencies to fix CVE-2025-55247
---
 src/Fable.Cli/Fable.Cli.fsproj | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/Fable.Cli/Fable.Cli.fsproj b/src/Fable.Cli/Fable.Cli.fsproj
index ccebcc7f3..be0299a88 100644
--- a/src/Fable.Cli/Fable.Cli.fsproj
+++ b/src/Fable.Cli/Fable.Cli.fsproj
@@ -43,6 +43,10 @@
   </ItemGroup>
   <ItemGroup>
     <PackageReference Include="Buildalyzer" Version="8.0.0-fable-001" />
+    <!-- Pin Microsoft.Build transitive dependencies to fix CVE-2025-55247 (GHSA-w3q9-fxm7-j8fq) -->
+    <PackageReference Include="Microsoft.Build" Version="17.10.46" />
+    <PackageReference Include="Microsoft.Build.Tasks.Core" Version="17.10.46" />
+    <PackageReference Include="Microsoft.Build.Utilities.Core" Version="17.10.46" />
     <PackageReference Include="EasyBuild.PackageReleaseNotes.Tasks" Version="2.0.0">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>